Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 06:52

General

  • Target

    Setup.exe

  • Size

    8.7MB

  • MD5

    480f8cf600f5509595b8418c6534caf2

  • SHA1

    dc13258ebb83bdf956523d751f67e29d6e4cf77e

  • SHA256

    6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2

  • SHA512

    f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf

  • SSDEEP

    196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://kitchenreviewbewrwsa.shop/api

https://birdpenallitysydw.shop/api

https://cinemaclinicttanwk.shop/api

https://disagreemenywyws.shop/api

https://speedparticipatewo.shop/api

https://fixturewordbakewos.shop/api

https://colorprioritytubbew.shop/api

https://abuselinenaidwjuew.shop/api

https://methodgreenglassdatw.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Suspicious use of SetThreadContext 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\SysWOW64\netsh.exe
      C:\Windows\SysWOW64\netsh.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3616
      • C:\Users\Admin\AppData\Local\Temp\RunDll.exe
        C:\Users\Admin\AppData\Local\Temp\RunDll.exe
        3⤵
        • Loads dropped DLL
        PID:208
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3908 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:968

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\1a26d6e2

            Filesize

            4.5MB

            MD5

            2afa1e9e48736a687ac1d81386e96954

            SHA1

            0635590a90d33bc15a38548bb4b566bd0bb450a9

            SHA256

            f340c791a9408118ac69c07bd71df107b57142e4a351b13ac84ccf7c51800e3e

            SHA512

            5365a5a00931796a8251eecc3be320c7a5bbab641cac38efa9a75d952ea70cc97251a74c85d966bc9633efb7ce178291361fdea788a0221c55780386529db340

          • C:\Users\Admin\AppData\Local\Temp\RunDll.exe

            Filesize

            3.6MB

            MD5

            726444379dbb621f5f117a2605425be1

            SHA1

            1700e8c51b39a8000bb41ee8b25940a6962c305b

            SHA256

            a642496f090ca7c54dc57e9ae6f5fe65b3a233dcdf7a2b734f58be23a388b1e9

            SHA512

            28f04eef12ae8d58dd67d956a1bcce0fc3dad579105c4be19432cb902b89977ffb8f9ac85506ce9461582276cd4c5c7be476016c4d9cf3f67bf7f1674c5cd267

          • memory/208-23-0x0000000000C80000-0x0000000000CCD000-memory.dmp

            Filesize

            308KB

          • memory/208-22-0x0000000000730000-0x0000000000ACA000-memory.dmp

            Filesize

            3.6MB

          • memory/208-20-0x0000000000C80000-0x0000000000CCD000-memory.dmp

            Filesize

            308KB

          • memory/208-19-0x00007FFE59330000-0x00007FFE59525000-memory.dmp

            Filesize

            2.0MB

          • memory/636-7-0x0000000073080000-0x00000000731FB000-memory.dmp

            Filesize

            1.5MB

          • memory/636-10-0x0000000000A40000-0x0000000001316000-memory.dmp

            Filesize

            8.8MB

          • memory/636-0-0x0000000001B60000-0x0000000001B61000-memory.dmp

            Filesize

            4KB

          • memory/636-6-0x0000000073080000-0x00000000731FB000-memory.dmp

            Filesize

            1.5MB

          • memory/636-2-0x00007FFE59330000-0x00007FFE59525000-memory.dmp

            Filesize

            2.0MB

          • memory/636-1-0x0000000073080000-0x00000000731FB000-memory.dmp

            Filesize

            1.5MB

          • memory/3616-12-0x00007FFE59330000-0x00007FFE59525000-memory.dmp

            Filesize

            2.0MB

          • memory/3616-14-0x0000000073080000-0x00000000731FB000-memory.dmp

            Filesize

            1.5MB

          • memory/3616-15-0x0000000073080000-0x00000000731FB000-memory.dmp

            Filesize

            1.5MB

          • memory/3616-9-0x0000000073080000-0x00000000731FB000-memory.dmp

            Filesize

            1.5MB